You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@hc.apache.org by ol...@apache.org on 2023/10/12 13:49:25 UTC
[httpcomponents-client] branch 5.2.x updated: HTTPCLIENT-2302: Add comment to TrustStrategy usage in examples (#492)
This is an automated email from the ASF dual-hosted git repository.
olegk pushed a commit to branch 5.2.x
in repository https://gitbox.apache.org/repos/asf/httpcomponents-client.git
The following commit(s) were added to refs/heads/5.2.x by this push:
new 32ce98d70 HTTPCLIENT-2302: Add comment to TrustStrategy usage in examples (#492)
32ce98d70 is described below
commit 32ce98d70403e59356928f0bf3b6151240d373a9
Author: Marcono1234 <ma...@users.noreply.github.com>
AuthorDate: Thu Oct 12 12:24:28 2023 +0200
HTTPCLIENT-2302: Add comment to TrustStrategy usage in examples (#492)
---
.../org/apache/hc/client5/http/examples/AsyncClientCustomSSL.java | 7 +++++++
.../java/org/apache/hc/client5/http/examples/ClientCustomSSL.java | 7 +++++++
2 files changed, 14 insertions(+)
diff --git a/httpclient5/src/test/java/org/apache/hc/client5/http/examples/AsyncClientCustomSSL.java b/httpclient5/src/test/java/org/apache/hc/client5/http/examples/AsyncClientCustomSSL.java
index 39cf958b4..01dab3c89 100644
--- a/httpclient5/src/test/java/org/apache/hc/client5/http/examples/AsyncClientCustomSSL.java
+++ b/httpclient5/src/test/java/org/apache/hc/client5/http/examples/AsyncClientCustomSSL.java
@@ -59,7 +59,14 @@ public class AsyncClientCustomSSL {
public static void main(final String[] args) throws Exception {
// Trust standard CA and those trusted by our custom strategy
final SSLContext sslContext = SSLContexts.custom()
+ // Custom TrustStrategy implementations are intended for verification
+ // of certificates whose CA is not trusted by the system, and where specifying
+ // a custom truststore containing the certificate chain is not an option.
.loadTrustMaterial((chain, authType) -> {
+ // Please note that validation of the server certificate without validation
+ // of the entire certificate chain in this example is preferred to completely
+ // disabling trust verification, however this still potentially allows
+ // for man-in-the-middle attacks.
final X509Certificate cert = chain[0];
return "CN=httpbin.org".equalsIgnoreCase(cert.getSubjectDN().getName());
})
diff --git a/httpclient5/src/test/java/org/apache/hc/client5/http/examples/ClientCustomSSL.java b/httpclient5/src/test/java/org/apache/hc/client5/http/examples/ClientCustomSSL.java
index 2e71a339b..d7b625203 100644
--- a/httpclient5/src/test/java/org/apache/hc/client5/http/examples/ClientCustomSSL.java
+++ b/httpclient5/src/test/java/org/apache/hc/client5/http/examples/ClientCustomSSL.java
@@ -55,7 +55,14 @@ public class ClientCustomSSL {
public final static void main(final String[] args) throws Exception {
// Trust standard CA and those trusted by our custom strategy
final SSLContext sslContext = SSLContexts.custom()
+ // Custom TrustStrategy implementations are intended for verification
+ // of certificates whose CA is not trusted by the system, and where specifying
+ // a custom truststore containing the certificate chain is not an option.
.loadTrustMaterial((chain, authType) -> {
+ // Please note that validation of the server certificate without validation
+ // of the entire certificate chain in this example is preferred to completely
+ // disabling trust verification, however this still potentially allows
+ // for man-in-the-middle attacks.
final X509Certificate cert = chain[0];
return "CN=httpbin.org".equalsIgnoreCase(cert.getSubjectDN().getName());
})